
<!doctype html>
<html lang="zh" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
        <meta name="description" content="脚本文档">
      
      
        <meta name="author" content="Logan">
      
      
        <link rel="canonical" href="http://localhost:8000/installation/kubernetes/">
      
      
        <link rel="prev" href="../docker-compose/">
      
      
        <link rel="next" href="resources/">
      
      
      <link rel="icon" href="../../image/favicon.ico">
      <meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.5.50">
    
    
      
        <title>集群部署 - 运维无忧文档</title>
      
    
    
      <link rel="stylesheet" href="../../assets/stylesheets/main.a40c8224.min.css">
      
        
        <link rel="stylesheet" href="../../assets/stylesheets/palette.06af60db.min.css">
      
      


    
    
      
    
    
      
        
        
        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
        <style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
      
    
    
      <link rel="stylesheet" href="../../css/extra.css">
    
      <link rel="stylesheet" href="../../css/prism.css">
    
    <script>__md_scope=new URL("../..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
    
      

    
    
    
  </head>
  
  
    
    
      
    
    
    
    
    <body dir="ltr" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="blue">
  
    
    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
    <label class="md-overlay" for="__drawer"></label>
    <div data-md-component="skip">
      
        
        <a href="#_1" class="md-skip">
          跳转至
        </a>
      
    </div>
    <div data-md-component="announce">
      
    </div>
    
    
      

  

<header class="md-header md-header--shadow" data-md-component="header">
  <nav class="md-header__inner md-grid" aria-label="页眉">
    <a href="../.." title="运维无忧文档" class="md-header__button md-logo" aria-label="运维无忧文档" data-md-component="logo">
      
  <img src="../../image/logo.png" alt="logo">

    </a>
    <label class="md-header__button md-icon" for="__drawer">
      
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"/></svg>
    </label>
    <div class="md-header__title" data-md-component="header-title">
      <div class="md-header__ellipsis">
        <div class="md-header__topic">
          <span class="md-ellipsis">
            运维无忧文档
          </span>
        </div>
        <div class="md-header__topic" data-md-component="header-topic">
          <span class="md-ellipsis">
            
              集群部署
            
          </span>
        </div>
      </div>
    </div>
    
      
        <form class="md-header__option" data-md-component="palette">
  
    
    
    
    <input class="md-option" data-md-color-media="" data-md-color-scheme="default" data-md-color-primary="indigo" data-md-color-accent="blue"  aria-label="Switch to dark mode"  type="radio" name="__palette" id="__palette_0">
    
      <label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_1" hidden>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 7a5 5 0 0 1 5 5 5 5 0 0 1-5 5 5 5 0 0 1-5-5 5 5 0 0 1 5-5m0 2a3 3 0 0 0-3 3 3 3 0 0 0 3 3 3 3 0 0 0 3-3 3 3 0 0 0-3-3m0-7 2.39 3.42C13.65 5.15 12.84 5 12 5s-1.65.15-2.39.42zM3.34 7l4.16-.35A7.2 7.2 0 0 0 5.94 8.5c-.44.74-.69 1.5-.83 2.29zm.02 10 1.76-3.77a7.131 7.131 0 0 0 2.38 4.14zM20.65 7l-1.77 3.79a7.02 7.02 0 0 0-2.38-4.15zm-.01 10-4.14.36c.59-.51 1.12-1.14 1.54-1.86.42-.73.69-1.5.83-2.29zM12 22l-2.41-3.44c.74.27 1.55.44 2.41.44.82 0 1.63-.17 2.37-.44z"/></svg>
      </label>
    
  
    
    
    
    <input class="md-option" data-md-color-media="" data-md-color-scheme="slate" data-md-color-primary="indigo" data-md-color-accent="blue"  aria-label="Switch to light mode"  type="radio" name="__palette" id="__palette_1">
    
      <label class="md-header__button md-icon" title="Switch to light mode" for="__palette_0" hidden>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="m17.75 4.09-2.53 1.94.91 3.06-2.63-1.81-2.63 1.81.91-3.06-2.53-1.94L12.44 4l1.06-3 1.06 3zm3.5 6.91-1.64 1.25.59 1.98-1.7-1.17-1.7 1.17.59-1.98L15.75 11l2.06-.05L18.5 9l.69 1.95zm-2.28 4.95c.83-.08 1.72 1.1 1.19 1.85-.32.45-.66.87-1.08 1.27C15.17 23 8.84 23 4.94 19.07c-3.91-3.9-3.91-10.24 0-14.14.4-.4.82-.76 1.27-1.08.75-.53 1.93.36 1.85 1.19-.27 2.86.69 5.83 2.89 8.02a9.96 9.96 0 0 0 8.02 2.89m-1.64 2.02a12.08 12.08 0 0 1-7.8-3.47c-2.17-2.19-3.33-5-3.49-7.82-2.81 3.14-2.7 7.96.31 10.98 3.02 3.01 7.84 3.12 10.98.31"/></svg>
      </label>
    
  
</form>
      
    
    
      <script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script>
    
    
    
      <label class="md-header__button md-icon" for="__search">
        
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
      </label>
      <div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" name="search">
      <input type="text" class="md-search__input" name="query" aria-label="搜索" placeholder="搜索" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
      <label class="md-search__icon md-icon" for="__search">
        
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"/></svg>
        
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg>
      </label>
      <nav class="md-search__options" aria-label="查找">
        
        <button type="reset" class="md-search__icon md-icon" title="清空当前内容" aria-label="清空当前内容" tabindex="-1">
          
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"/></svg>
        </button>
      </nav>
      
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" tabindex="0" data-md-scrollfix>
        <div class="md-search-result" data-md-component="search-result">
          <div class="md-search-result__meta">
            正在初始化搜索引擎
          </div>
          <ol class="md-search-result__list" role="presentation"></ol>
        </div>
      </div>
    </div>
  </div>
</div>
    
    
      <div class="md-header__source">
        <a href="https://git.opsx.vip/docs/wuyou.run.git" title="前往仓库" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 6.7.2 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81"/></svg>
  </div>
  <div class="md-source__repository">
    wuyou.run
  </div>
</a>
      </div>
    
  </nav>
  
</header>
    
    <div class="md-container" data-md-component="container">
      
      
        
          
        
      
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    



<nav class="md-nav md-nav--primary" aria-label="导航栏" data-md-level="0">
  <label class="md-nav__title" for="__drawer">
    <a href="../.." title="运维无忧文档" class="md-nav__button md-logo" aria-label="运维无忧文档" data-md-component="logo">
      
  <img src="../../image/logo.png" alt="logo">

    </a>
    运维无忧文档
  </label>
  
    <div class="md-nav__source">
      <a href="https://git.opsx.vip/docs/wuyou.run.git" title="前往仓库" class="md-source" data-md-component="source">
  <div class="md-source__icon md-icon">
    
    <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 6.7.2 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M439.55 236.05 244 40.45a28.87 28.87 0 0 0-40.81 0l-40.66 40.63 51.52 51.52c27.06-9.14 52.68 16.77 43.39 43.68l49.66 49.66c34.23-11.8 61.18 31 35.47 56.69-26.49 26.49-70.21-2.87-56-37.34L240.22 199v121.85c25.3 12.54 22.26 41.85 9.08 55a34.34 34.34 0 0 1-48.55 0c-17.57-17.6-11.07-46.91 11.25-56v-123c-20.8-8.51-24.6-30.74-18.64-45L142.57 101 8.45 235.14a28.86 28.86 0 0 0 0 40.81l195.61 195.6a28.86 28.86 0 0 0 40.8 0l194.69-194.69a28.86 28.86 0 0 0 0-40.81"/></svg>
  </div>
  <div class="md-source__repository">
    wuyou.run
  </div>
</a>
    </div>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
      
  
  
  
  
    <li class="md-nav__item">
      <a href="../.." class="md-nav__link">
        
  
  <span class="md-ellipsis">
    首页
  </span>
  

      </a>
    </li>
  

    
      
      
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2" >
        
          
          <label class="md-nav__link" for="__nav_2" id="__nav_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Linux基础设施
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2">
            <span class="md-nav__icon md-icon"></span>
            Linux基础设施
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_1" >
        
          
          <label class="md-nav__link" for="__nav_2_1" id="__nav_2_1_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    基础环境配置
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_1_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_1">
            <span class="md-nav__icon md-icon"></span>
            基础环境配置
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../system_init/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    系统初始化
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../dev_env/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    开发环境搭建
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

              
            
              
                
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_2" >
        
          
          <label class="md-nav__link" for="__nav_2_2" id="__nav_2_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    常用服务部署
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_2">
            <span class="md-nav__icon md-icon"></span>
            常用服务部署
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_2_1" >
        
          
          <label class="md-nav__link" for="__nav_2_2_1" id="__nav_2_2_1_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Web服务与代理
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="3" aria-labelledby="__nav_2_2_1_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_2_1">
            <span class="md-nav__icon md-icon"></span>
            Web服务与代理
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../web_services/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Web服务
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../proxy_services/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    代理服务
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../services-loadbalancing/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    负载均衡服务
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../cache_services/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    缓存加速服务
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

              
            
              
                
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_2_2" >
        
          
          <label class="md-nav__link" for="__nav_2_2_2" id="__nav_2_2_2_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    数据存储
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="3" aria-labelledby="__nav_2_2_2_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_2_2">
            <span class="md-nav__icon md-icon"></span>
            数据存储
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../database_services/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    数据库服务
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../storage_services/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    文件存储服务
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

              
            
              
                
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_2_3" >
        
          
          <label class="md-nav__link" for="__nav_2_2_3" id="__nav_2_2_3_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    监控与日志
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="3" aria-labelledby="__nav_2_2_3_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_2_3">
            <span class="md-nav__icon md-icon"></span>
            监控与日志
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../monitoring_services/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    监控系统
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../logging_services/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    日志管理
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../message_queue_services/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    消息队列
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

              
            
              
                
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2_3" >
        
          
          <label class="md-nav__link" for="__nav_2_3" id="__nav_2_3_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    系统运维
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_2_3_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_2_3">
            <span class="md-nav__icon md-icon"></span>
            系统运维
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../storage/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    存储与备份
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../lvm/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    LVM存储管理
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../network/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    网络服务配置
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../monitor/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    监控与日志
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

    
      
      
  
  
    
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--active md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3" checked>
        
          
          <label class="md-nav__link" for="__nav_3" id="__nav_3_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    容器与编排
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_3_label" aria-expanded="true">
          <label class="md-nav__title" for="__nav_3">
            <span class="md-nav__icon md-icon"></span>
            容器与编排
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3_1" >
        
          
          <label class="md-nav__link" for="__nav_3_1" id="__nav_3_1_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Docker
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_1_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_3_1">
            <span class="md-nav__icon md-icon"></span>
            Docker
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../docker/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    基础安装
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../docker/build/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    镜像构建
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../docker/services/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    常用服务部署
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../docker/network-storage/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    网络与存储
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../docker-compose/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Docker Compose
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
    
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--active md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_3_3" checked>
        
          
          <label class="md-nav__link" for="__nav_3_3" id="__nav_3_3_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Kubernetes
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="2" aria-labelledby="__nav_3_3_label" aria-expanded="true">
          <label class="md-nav__title" for="__nav_3_3">
            <span class="md-nav__icon md-icon"></span>
            Kubernetes
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
    
  
  
  
    <li class="md-nav__item md-nav__item--active">
      
      <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
      
      
        
      
      
      <a href="./" class="md-nav__link md-nav__link--active">
        
  
  <span class="md-ellipsis">
    集群部署
  </span>
  

      </a>
      
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="resources/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    资源管理
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="operations/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    运维操作
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="best-practices/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    最佳实践
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

    
      
      
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4" >
        
          
          <label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    DevOps工具链
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_4">
            <span class="md-nav__icon md-icon"></span>
            DevOps工具链
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../cicd/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    CI/CD流水线
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../devops/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    自动化运维
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

    
      
      
  
  
  
  
    
    
    
    
    <li class="md-nav__item md-nav__item--nested">
      
        
        
        <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" >
        
          
          <label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
            
  
  <span class="md-ellipsis">
    Shell 快速入门
  </span>
  

            <span class="md-nav__icon md-icon"></span>
          </label>
        
        <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
          <label class="md-nav__title" for="__nav_5">
            <span class="md-nav__icon md-icon"></span>
            Shell 快速入门
          </label>
          <ul class="md-nav__list" data-md-scrollfix>
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../shell/introduction/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Linux 基础命令
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../shell/commands/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    常用命令集
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../shell/variables_and_data_types/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    变量和数据类型
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../shell/control_flow/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    控制流程 (if、else、for、while)
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../shell/functions/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Shell函数
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../shell/text_processing/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    文本处理三剑客
  </span>
  

      </a>
    </li>
  

              
            
              
                
  
  
  
  
    <li class="md-nav__item">
      <a href="../../shell/scripts/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Shell脚本实战
  </span>
  

      </a>
    </li>
  

              
            
          </ul>
        </nav>
      
    </li>
  

    
  </ul>
</nav>
                  </div>
                </div>
              </div>
            
            
              
              <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

<nav class="md-nav md-nav--secondary" aria-label="目录">
  
  
  
    
  
  
</nav>
                  </div>
                </div>
              </div>
            
          
          
            <div class="md-content" data-md-component="content">
              <article class="md-content__inner md-typeset">
                
                  

  
  


<h1 id="_1">所有节点：安装必要的依赖</h1>
<p>apt-get update
apt-get install -y apt-transport-https ca-certificates curl software-properties-common</p>
<h1 id="kubernetes">添加Kubernetes仓库</h1>
<p>curl -s https://mirrors.aliyun.com/kubernetes/apt/doc/apt-key.gpg | apt-key add -
cat &gt; /etc/apt/sources.list.d/kubernetes.list &lt;&lt;EOF
deb https://mirrors.aliyun.com/kubernetes/apt/ kubernetes-xenial main
EOF</p>
<h1 id="kubeletkubeadmkubectl">安装kubelet、kubeadm和kubectl</h1>
<p>apt-get update
apt-get install -y kubelet kubeadm kubectl
apt-mark hold kubelet kubeadm kubectl</p>
<h1 id="swap">关闭swap</h1>
<p>swapoff -a
sed -i '/swap/s/^/#/' /etc/fstab</p>
<h1 id="_2">加载内核模块</h1>
<p>cat &gt; /etc/modules-load.d/k8s.conf &lt;&lt;EOF
overlay
br_netfilter
EOF
modprobe overlay
modprobe br_netfilter</p>
<h1 id="_3">设置必要的内核参数</h1>
<p>cat &gt; /etc/sysctl.d/k8s.conf &lt;&lt;EOF
net.bridge.bridge-nf-call-iptables  = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward                 = 1
EOF
sysctl --system</p>
<h1 id="_4">主节点：初始化集群</h1>
<p>kubeadm init \
  --image-repository registry.aliyuncs.com/google_containers \
  --kubernetes-version v1.23.0 \
  --pod-network-cidr=10.244.0.0/16</p>
<h1 id="kubectl">配置kubectl</h1>
<p>mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config</p>
<h1 id="calico">安装网络插件(Calico)</h1>
<p>kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml</p>
<h1 id="_5">工作节点：加入集群</h1>
<h1 id="kubeadm-init">使用主节点kubeadm init输出的命令</h1>
<p>kubeadm join <control-plane-host>:<control-plane-port> \
  --token <token> \
  --discovery-token-ca-cert-hash sha256:<hash></p>
<pre><code>
### 二进制部署

适合生产环境的二进制部署方式更为灵活，但步骤较多，主要包括：

1. 准备证书和密钥
2. 部署etcd集群
3. 部署Master组件
4. 部署Node组件
5. 配置网络插件

详细步骤请参考官方文档或专业Kubernetes运维书籍。

## Kubernetes常用命令

### 集群管理命令

```bash
# 查看集群状态
kubectl cluster-info
kubectl get nodes
kubectl get namespaces

# 查看集群资源使用情况
kubectl top nodes
kubectl top pods --all-namespaces

# 查看API资源
kubectl api-resources
kubectl api-versions

# 查看组件状态
kubectl get componentstatuses
kubectl get cs

# 查看集群事件
kubectl get events --sort-by='.metadata.creationTimestamp'
</code></pre>
<h3 id="_6">资源管理命令</h3>
<pre><code class="language-bash"># 创建资源
kubectl create -f manifest.yaml
kubectl apply -f manifest.yaml

# 查看资源
kubectl get &lt;resource-type&gt; [-n namespace]
kubectl get pods,services,deployments -n kube-system

# 查看资源详情
kubectl describe &lt;resource-type&gt; &lt;resource-name&gt; [-n namespace]
kubectl describe pod nginx-pod -n default

# 删除资源
kubectl delete &lt;resource-type&gt; &lt;resource-name&gt; [-n namespace]
kubectl delete -f manifest.yaml

# 编辑资源
kubectl edit &lt;resource-type&gt; &lt;resource-name&gt; [-n namespace]

# 标签管理
kubectl label &lt;resource-type&gt; &lt;resource-name&gt; key=value
kubectl label &lt;resource-type&gt; &lt;resource-name&gt; key-

# 缩放资源
kubectl scale deployment &lt;name&gt; --replicas=3
</code></pre>
<h3 id="_7">日志和调试命令</h3>
<pre><code class="language-bash"># 查看Pod日志
kubectl logs &lt;pod-name&gt; [-c container-name] [-n namespace] [-f]

# 执行命令
kubectl exec -it &lt;pod-name&gt; [-c container-name] -- &lt;command&gt;
kubectl exec -it nginx-pod -- bash

# 端口转发
kubectl port-forward &lt;pod-name&gt; &lt;local-port&gt;:&lt;pod-port&gt;
kubectl port-forward service/&lt;service-name&gt; &lt;local-port&gt;:&lt;service-port&gt;

# 复制文件到Pod
kubectl cp &lt;local-file&gt; &lt;pod-name&gt;:/&lt;remote-path&gt;
kubectl cp &lt;pod-name&gt;:/&lt;remote-path&gt; &lt;local-file&gt;

# 查看node详情
kubectl describe node &lt;node-name&gt;
</code></pre>
<h3 id="_8">上下文和命名空间</h3>
<pre><code class="language-bash"># 查看上下文
kubectl config get-contexts
kubectl config current-context

# 切换上下文
kubectl config use-context &lt;context-name&gt;

# 创建命名空间
kubectl create namespace &lt;namespace-name&gt;

# 切换默认命名空间
kubectl config set-context --current --namespace=&lt;namespace&gt;
</code></pre>
<h2 id="kubernetes_1">Kubernetes资源管理</h2>
<h3 id="pod">Pod</h3>
<p>Pod是Kubernetes中最小的可部署单元。</p>
<pre><code class="language-yaml">apiVersion: v1
kind: Pod
metadata:
  name: nginx-pod
  labels:
    app: nginx
spec:
  containers:
  - name: nginx
    image: nginx:alpine
    ports:
    - containerPort: 80
</code></pre>
<h3 id="deployment">Deployment</h3>
<p>Deployment提供声明式更新和应用管理。</p>
<pre><code class="language-yaml">apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:alpine
        ports:
        - containerPort: 80
</code></pre>
<h3 id="deployment_1">Deployment示例</h3>
<p>以下是一个完整的Deployment示例，包含资源限制、健康检查、环境变量等：</p>
<pre><code class="language-yaml">apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app
  namespace: default
  labels:
    app: web-app
    tier: frontend
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-app
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: web-app
        tier: frontend
    spec:
      containers:
      - name: web-app
        image: nginx:alpine
        imagePullPolicy: Always
        ports:
        - containerPort: 80
          name: http
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 200m
            memory: 256Mi
        env:
        - name: ENV_TYPE
          value: &quot;production&quot;
        - name: DB_HOST
          valueFrom:
            configMapKeyRef:
              name: app-config
              key: db_host
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: app-secrets
              key: db_password
        livenessProbe:
          httpGet:
            path: /healthz
            port: http
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /ready
            port: http
          initialDelaySeconds: 5
          periodSeconds: 5
        volumeMounts:
        - name: config-volume
          mountPath: /etc/config
        - name: data-volume
          mountPath: /data
      volumes:
      - name: config-volume
        configMap:
          name: app-config
      - name: data-volume
        persistentVolumeClaim:
          claimName: app-data-pvc
</code></pre>
<h3 id="service">Service</h3>
<p>Service定义一组Pod的访问方式和负载均衡。</p>
<pre><code class="language-yaml">apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 80
  type: ClusterIP  # 可选: ClusterIP, NodePort, LoadBalancer
</code></pre>
<h3 id="configmapsecret">ConfigMap和Secret</h3>
<p>用于配置管理和敏感信息存储。</p>
<pre><code class="language-yaml"># ConfigMap示例
apiVersion: v1
kind: ConfigMap
metadata:
  name: app-config
data:
  config.json: |
    {
      &quot;database&quot;: &quot;mysql&quot;,
      &quot;host&quot;: &quot;db-service&quot;
    }

# Secret示例
apiVersion: v1
kind: Secret
metadata:
  name: db-credentials
type: Opaque
data:
  username: YWRtaW4=  # base64编码的&quot;admin&quot;
  password: cGFzc3dvcmQ=  # base64编码的&quot;password&quot;
</code></pre>
<h2 id="ingress">Ingress控制器与路由</h2>
<h3 id="ingress_1">Ingress基本概念</h3>
<p>Ingress是Kubernetes中暴露HTTP和HTTPS服务的对象，提供了负载均衡、SSL终止和基于名称的虚拟主机等功能。</p>
<h3 id="ingress_2">安装Ingress控制器</h3>
<pre><code class="language-bash"># 安装Nginx Ingress控制器
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.0/deploy/static/provider/cloud/deploy.yaml

# 验证安装
kubectl get pods -n ingress-nginx
kubectl get services -n ingress-nginx
</code></pre>
<h3 id="ingress_3">Ingress示例配置</h3>
<p>基本Ingress配置：</p>
<pre><code class="language-yaml">apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minimal-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: example-service
            port:
              number: 80
</code></pre>
<p>带TLS的Ingress配置：</p>
<pre><code class="language-yaml">apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-ingress
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - example.com
    secretName: example-tls
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: example-service
            port:
              number: 80
</code></pre>
<p>基于路径的路由：</p>
<pre><code class="language-yaml">apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: path-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
      - path: /web
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
</code></pre>
<h2 id="_9">网络配置</h2>
<h3 id="_10">网络模型</h3>
<p>Kubernetes网络模型要求：</p>
<ul>
<li>所有Pod间无NAT通信</li>
<li>所有节点与所有Pod间无NAT通信</li>
<li>Pod内部IP与其他组件看到的IP相同</li>
</ul>
<h3 id="_11">网络插件选择</h3>
<ul>
<li><strong>Calico</strong>：基于BGP协议，支持网络策略</li>
<li><strong>Flannel</strong>：简单易用，适合小型集群</li>
<li><strong>Cilium</strong>：基于eBPF技术，提供高级网络功能</li>
<li><strong>Weave Net</strong>：多集群支持，适合混合云环境</li>
</ul>
<pre><code class="language-bash"># 安装Calico
kubectl apply -f https://docs.projectcalico.org/manifests/calico.yaml

# 安装Flannel
kubectl apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
</code></pre>
<h3 id="_12">网络策略</h3>
<p>控制Pod间的通信：</p>
<pre><code class="language-yaml">apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: db-network-policy
  namespace: default
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: api
    ports:
    - protocol: TCP
      port: 3306
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: monitoring
    ports:
    - protocol: TCP
      port: 8086
</code></pre>
<h2 id="_13">存储配置</h2>
<h3 id="storageclass">存储类(StorageClass)</h3>
<pre><code class="language-yaml">apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: standard
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp2
reclaimPolicy: Retain
allowVolumeExpansion: true
</code></pre>
<h3 id="pvpvc">持久卷(PV)和持久卷声明(PVC)</h3>
<pre><code class="language-yaml"># 持久卷
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-volume
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: standard
  nfs:
    path: /data
    server: nfs-server.example.com

# 持久卷声明
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pv-claim
spec:
  storageClassName: standard
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
</code></pre>
<h2 id="rbac">RBAC权限控制</h2>
<h3 id="rbac_1">RBAC基本概念</h3>
<p>RBAC（基于角色的访问控制）使用以下对象管理Kubernetes的授权：</p>
<ul>
<li>Role/ClusterRole：定义可执行的操作</li>
<li>RoleBinding/ClusterRoleBinding：将角色绑定到用户</li>
</ul>
<h3 id="_14">创建命名空间内的角色</h3>
<pre><code class="language-yaml">apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
</code></pre>
<h3 id="rolebinding">创建RoleBinding</h3>
<pre><code class="language-yaml">apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<h3 id="_15">创建服务账号并分配权限</h3>
<pre><code class="language-bash"># 创建命名空间
kubectl create namespace demo

# 创建RBAC资源
cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: demo-pods-admin
  namespace: demo

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pods-reader-writer
  namespace: demo
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;, &quot;create&quot;, &quot;delete&quot;, &quot;patch&quot;]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pods-reader-writer
  namespace: demo
subjects:
- kind: ServiceAccount
  name: demo-pods-admin
  namespace: demo
roleRef:
  kind: Role
  name: pods-reader-writer
  apiGroup: rbac.authorization.k8s.io
EOF

# 查看并获取Token
kubectl -n demo get secrets | grep admin
kubectl -n demo describe secrets demo-pods-admin-token-xxxxx  # 使用上一步获取的token名称
</code></pre>
<h3 id="_16">创建只读账号和管理员账号</h3>
<pre><code class="language-bash"># 创建只读用户
kubectl create serviceaccount sre-api-reader -n kube-system 

# 绑定用户授权角色（只读）
kubectl create clusterrolebinding sre-api-reader-crb \
  --clusterrole=view \
  --serviceaccount=kube-system:sre-api-reader 

# 获取用户Token
kubectl describe secrets -n kube-system $(kubectl -n kube-system get secret | awk '/sre-api-reader/{print $1}')

# 创建管理员用户
kubectl create serviceaccount sre-api -n kube-system 

# 绑定用户授权角色（管理员）
kubectl create clusterrolebinding sre-api-crb \
  --clusterrole=cluster-admin \
  --serviceaccount=kube-system:sre-api

# 获取管理员Token
kubectl describe secrets -n kube-system $(kubectl -n kube-system get secret | awk '/sre-api/{print $1}')
</code></pre>
<h3 id="rbac_2">查询和删除RBAC对象</h3>
<pre><code class="language-bash"># 查询RBAC对象
kubectl -n kube-system get sa | grep sre
kubectl -n kube-system get secrets | grep api
kubectl -n kube-system get role | grep api
kubectl get clusterrolebinding | grep sre
kubectl -n kube-system get ClusterRole | egrep &quot;^view|cluster-admin&quot;

# 删除RBAC对象
kubectl delete clusterrolebinding sre-api-reader-crb
kubectl -n kube-system delete sa sre-api-reader
</code></pre>
<h2 id="pod_1">Pod安全策略</h2>
<pre><code class="language-yaml">apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: restricted
spec:
  privileged: false
  seLinux:
    rule: RunAsAny
  runAsUser:
    rule: MustRunAsNonRoot
  fsGroup:
    rule: RunAsAny
  volumes:
  - 'configMap'
  - 'emptyDir'
  - 'projected'
  - 'secret'
  - 'downwardAPI'
  - 'persistentVolumeClaim'
</code></pre>
<h2 id="_17">集群监控</h2>
<h3 id="prometheus-grafana">Prometheus + Grafana监控方案</h3>
<pre><code class="language-bash"># 添加Helm仓库
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

# 安装Prometheus Stack
helm install prometheus prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace
</code></pre>
<h3 id="prometheus">自定义Prometheus配置</h3>
<pre><code class="language-yaml">apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-config
  namespace: monitoring
data:
  prometheus.yml: |
    global:
      scrape_interval: 15s
      evaluation_interval: 15s

    scrape_configs:
      - job_name: 'kubernetes-apiservers'
        kubernetes_sd_configs:
        - role: endpoints
        scheme: https
        tls_config:
          ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
        relabel_configs:
        - source_labels: [__meta_kubernetes_namespace, __meta_kubernetes_service_name, __meta_kubernetes_endpoint_port_name]
          action: keep
          regex: default;kubernetes;https
</code></pre>
<h3 id="grafana-dashboard">自定义Grafana Dashboard配置</h3>
<pre><code class="language-yaml">apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-dashboard-config
  namespace: monitoring
data:
  dashboard.json: |
    {
      &quot;dashboard&quot;: {
        &quot;title&quot;: &quot;Kubernetes Cluster Overview&quot;,
        &quot;panels&quot;: [
          {
            &quot;title&quot;: &quot;CPU Usage&quot;,
            &quot;type&quot;: &quot;graph&quot;,
            &quot;datasource&quot;: &quot;Prometheus&quot;,
            &quot;targets&quot;: [
              {
                &quot;expr&quot;: &quot;sum(rate(container_cpu_usage_seconds_total{container!=\&quot;POD\&quot;,container!=\&quot;\&quot;}[5m])) by (pod, namespace)&quot;
              }
            ]
          }
        ]
      }
    }
</code></pre>
<h3 id="_18">资源监控命令</h3>
<pre><code class="language-bash"># 查看节点资源使用情况
kubectl top nodes

# 查看Pod资源使用情况
kubectl top pods -n kube-system

# 查看集群总体健康状况
kubectl get cs
</code></pre>
<h2 id="pythonkubernetes-api">使用Python操作Kubernetes API</h2>
<h3 id="kubernetes-python">安装Kubernetes Python客户端</h3>
<pre><code class="language-bash">pip install kubernetes
</code></pre>
<h3 id="_19">基本用法示例</h3>
<pre><code class="language-python">from kubernetes import client, config

# 加载kubeconfig文件
config.load_kube_config()

# 创建API客户端
v1 = client.CoreV1Api()

# 获取所有Pod
ret = v1.list_pod_for_all_namespaces(watch=False)
for i in ret.items:
    print(&quot;%s\t%s\t%s&quot; % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))

# 创建命名空间
namespace = client.V1Namespace(
    metadata=client.V1ObjectMeta(name=&quot;test-namespace&quot;)
)
v1.create_namespace(namespace)

# 创建Pod
pod = client.V1Pod(
    metadata=client.V1ObjectMeta(name=&quot;test-pod&quot;),
    spec=client.V1PodSpec(
        containers=[
            client.V1Container(
                name=&quot;web&quot;,
                image=&quot;nginx:1.14.2&quot;,
                ports=[client.V1ContainerPort(container_port=80)]
            )
        ]
    )
)
v1.create_namespaced_pod(namespace=&quot;default&quot;, body=pod)
</code></pre>
<h3 id="tokenapi">使用Token认证访问API</h3>
<pre><code class="language-python">from kubernetes import client, config

# 配置API服务器和Token
configuration = client.Configuration()
configuration.host = &quot;https://kubernetes.example.com:6443&quot;
configuration.verify_ssl = False
configuration.api_key = {&quot;authorization&quot;: &quot;Bearer &quot; + &quot;your-token-here&quot;}
configuration.api_key_prefix = {&quot;authorization&quot;: &quot;Bearer&quot;}

client.Configuration.set_default(configuration)

# 使用配置创建API客户端
v1 = client.CoreV1Api()
print(&quot;Listing pods with their IPs:&quot;)
ret = v1.list_pod_for_all_namespaces(watch=False)
for i in ret.items:
    print(&quot;%s\t%s\t%s&quot; % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))
</code></pre>
<h3 id="pod_2">监控Pod状态</h3>
<pre><code class="language-python">from kubernetes import client, config, watch

# 加载配置
config.load_kube_config()
v1 = client.CoreV1Api()

# 监控Pod事件
w = watch.Watch()
for event in w.stream(v1.list_namespaced_pod, namespace=&quot;default&quot;):
    print(f&quot;Event: {event['type']}&quot;)
    print(f&quot;Pod Name: {event['object'].metadata.name}&quot;)
    print(f&quot;Pod Status: {event['object'].status.phase}&quot;)

    # 如果需要，可以在这里添加条件来停止监听
    if event['object'].metadata.name == &quot;my-pod&quot; and event['object'].status.phase == &quot;Running&quot;:
        w.stop()
</code></pre>
<h2 id="_20">常见问题排查</h2>
<h3 id="_21">节点状态问题</h3>
<pre><code class="language-bash"># 查看节点状态
kubectl get nodes

# 查看节点详情
kubectl describe node &lt;node-name&gt;

# 检查节点日志
journalctl -u kubelet
</code></pre>
<h3 id="pod_3">Pod启动问题</h3>
<pre><code class="language-bash"># 查看Pod状态
kubectl get pods -n &lt;namespace&gt;

# 查看Pod详情
kubectl describe pod &lt;pod-name&gt; -n &lt;namespace&gt;

# 查看Pod日志
kubectl logs &lt;pod-name&gt; -n &lt;namespace&gt;

# 查看Pod内容器日志
kubectl logs &lt;pod-name&gt; -c &lt;container-name&gt; -n &lt;namespace&gt;
</code></pre>
<h3 id="_22">网络连通性问题</h3>
<pre><code class="language-bash"># 临时创建调试Pod
kubectl run debug --image=nicolaka/netshoot -it --rm -- bash

# 检查DNS解析
nslookup kubernetes.default.svc.cluster.local

# 检查网络策略
kubectl get networkpolicies -A
</code></pre>
<h2 id="_23">高可用部署</h2>
<h3 id="_24">控制平面高可用</h3>
<p>设置至少3个master节点，使用负载均衡器分发API请求。</p>
<pre><code class="language-bash"># 初始化第一个master节点
kubeadm init \
  --control-plane-endpoint &quot;LOAD_BALANCER_DNS:LOAD_BALANCER_PORT&quot; \
  --upload-certs \
  --pod-network-cidr=10.244.0.0/16

# 添加其他master节点
kubeadm join LOAD_BALANCER_DNS:LOAD_BALANCER_PORT \
  --token &lt;token&gt; \
  --discovery-token-ca-cert-hash sha256:&lt;hash&gt; \
  --control-plane \
  --certificate-key &lt;certificate-key&gt;
</code></pre>
<h3 id="etcd">etcd高可用</h3>
<p>推荐部署至少3节点的etcd集群，确保数据的高可用性。</p>
<p>```bash</p>
<h1 id="etcd_1">查看etcd集群健康状态</h1>
<p>kubectl -n kube-system exec -it etcd-<master-node> -- etcdctl \
  --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  member list</p>












                
              </article>
            </div>
          
          
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
        </div>
        
      </main>
      
        <footer class="md-footer">
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
  
    Made with
    <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
      Material for MkDocs
    </a>
  
</div>
      
        <div class="md-social">
  
    
    
    
    
      
      
    
    <a href="https://git.opsx.vip/docs/PythonFullStackGuide.git" target="_blank" rel="noopener" title="git.opsx.vip" class="md-social__link">
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 496 512"><!--! Font Awesome Free 6.7.2 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M165.9 397.4c0 2-2.3 3.6-5.2 3.6-3.3.3-5.6-1.3-5.6-3.6 0-2 2.3-3.6 5.2-3.6 3-.3 5.6 1.3 5.6 3.6m-31.1-4.5c-.7 2 1.3 4.3 4.3 4.9 2.6 1 5.6 0 6.2-2s-1.3-4.3-4.3-5.2c-2.6-.7-5.5.3-6.2 2.3m44.2-1.7c-2.9.7-4.9 2.6-4.6 4.9.3 2 2.9 3.3 5.9 2.6 2.9-.7 4.9-2.6 4.6-4.6-.3-1.9-3-3.2-5.9-2.9M244.8 8C106.1 8 0 113.3 0 252c0 110.9 69.8 205.8 169.5 239.2 12.8 2.3 17.3-5.6 17.3-12.1 0-6.2-.3-40.4-.3-61.4 0 0-70 15-84.7-29.8 0 0-11.4-29.1-27.8-36.6 0 0-22.9-15.7 1.6-15.4 0 0 24.9 2 38.6 25.8 21.9 38.6 58.6 27.5 72.9 20.9 2.3-16 8.8-27.1 16-33.7-55.9-6.2-112.3-14.3-112.3-110.5 0-27.5 7.6-41.3 23.6-58.9-2.6-6.5-11.1-33.3 2.6-67.9 20.9-6.5 69 27 69 27 20-5.6 41.5-8.5 62.8-8.5s42.8 2.9 62.8 8.5c0 0 48.1-33.6 69-27 13.7 34.7 5.2 61.4 2.6 67.9 16 17.7 25.8 31.5 25.8 58.9 0 96.5-58.9 104.2-114.8 110.5 9.2 7.9 17 22.9 17 46.4 0 33.7-.3 75.4-.3 83.6 0 6.5 4.6 14.4 17.3 12.1C428.2 457.8 496 362.9 496 252 496 113.3 383.5 8 244.8 8M97.2 352.9c-1.3 1-1 3.3.7 5.2 1.6 1.6 3.9 2.3 5.2 1 1.3-1 1-3.3-.7-5.2-1.6-1.6-3.9-2.3-5.2-1m-10.8-8.1c-.7 1.3.3 2.9 2.3 3.9 1.6 1 3.6.7 4.3-.7.7-1.3-.3-2.9-2.3-3.9-2-.6-3.6-.3-4.3.7m32.4 35.6c-1.6 1.3-1 4.3 1.3 6.2 2.3 2.3 5.2 2.6 6.5 1 1.3-1.3.7-4.3-1.3-6.2-2.2-2.3-5.2-2.6-6.5-1m-11.4-14.7c-1.6 1-1.6 3.6 0 5.9s4.3 3.3 5.6 2.3c1.6-1.3 1.6-3.9 0-6.2-1.4-2.3-4-3.3-5.6-2"/></svg>
    </a>
  
    
    
    
    
    <a href="mailto:admin@attacker.club" target="_blank" rel="noopener" title="" class="md-social__link">
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><!--! Font Awesome Free 6.7.2 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2024 Fonticons, Inc.--><path d="M48 64C21.5 64 0 85.5 0 112c0 15.1 7.1 29.3 19.2 38.4l217.6 163.2c11.4 8.5 27 8.5 38.4 0l217.6-163.2c12.1-9.1 19.2-23.3 19.2-38.4 0-26.5-21.5-48-48-48zM0 176v208c0 35.3 28.7 64 64 64h384c35.3 0 64-28.7 64-64V176L294.4 339.2a63.9 63.9 0 0 1-76.8 0z"/></svg>
    </a>
  
</div>
      
    </div>
  </div>
</footer>
      
    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    
    
    <script id="__config" type="application/json">{"base": "../..", "features": [], "search": "../../assets/javascripts/workers/search.f8cc74c7.min.js", "translations": {"clipboard.copied": "\u5df2\u590d\u5236", "clipboard.copy": "\u590d\u5236", "search.result.more.one": "\u5728\u8be5\u9875\u4e0a\u8fd8\u6709 1 \u4e2a\u7b26\u5408\u6761\u4ef6\u7684\u7ed3\u679c", "search.result.more.other": "\u5728\u8be5\u9875\u4e0a\u8fd8\u6709 # \u4e2a\u7b26\u5408\u6761\u4ef6\u7684\u7ed3\u679c", "search.result.none": "\u6ca1\u6709\u627e\u5230\u7b26\u5408\u6761\u4ef6\u7684\u7ed3\u679c", "search.result.one": "\u627e\u5230 1 \u4e2a\u7b26\u5408\u6761\u4ef6\u7684\u7ed3\u679c", "search.result.other": "# \u4e2a\u7b26\u5408\u6761\u4ef6\u7684\u7ed3\u679c", "search.result.placeholder": "\u952e\u5165\u4ee5\u5f00\u59cb\u641c\u7d22", "search.result.term.missing": "\u7f3a\u5c11", "select.version": "\u9009\u62e9\u5f53\u524d\u7248\u672c"}}</script>
    
    
      <script src="../../assets/javascripts/bundle.60a45f97.min.js"></script>
      
        <script src="../../js/prism.js"></script>
      
    
  </body>
</html>